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SUMMARY 


PURPOSE: (U/ ^OUO ) To forward to the Intelligence Oversight Board (lOB) of the 
President’s Foreign Intelligence Advisory Board, via the Assistant to the Secretary of Defense 
for Intelligence Oversight (ATSD(IO)), NSA’s quarterly report on its intelligence activities. 

BACKGROUND: (U//FOUO) Executive Order 12333 and Executive Order 12863 
require Intelligence Community agency heads and Intelligence Community General Counsels 
and Inspectors General, respectively, to report to the lOB on a quarterly basis concerning 
intelligence activities that they have reason to believe may be unlawful or contrary to Executive 
Order or Presidential Directive. The enclosed memorandum covers all reportable activities 
known to the Inspector General and General Counsel. Per PIOB letter of 6 August 1982, 
Agency heads are responsible for reporting separately any additional reportable activities 
known to them, unless the President has specifically instructed that the Board is not to be 
informed. The Director’s signature signifies that no other activities that require reporting are 
known to him. 

RECOMMENDATION: (U//FOUO) Director sign the enclosed memorandum. 
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NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 

FORT GEORGE G. MEADE. MARYLAND 207S5-6000 

18 September 2003 

MEMORANDUM FOR THE CHAIRMAN, INTELLIGENCE OVERSIGHT BOARD 

THRU: Assistant to the Secretary of Defense (Intelligence Oversight) 

SUBJECT: (U//FOU€8 Report to the Intelligence Oversight Board on NSA 
Activities ■ INFORMATION MEMORANDUM 


DpCTD: 4165184 



(U//rOUO) Except as previously reported to you or the President, or 
otherwise stated in the enclosure, we have no reason to believe that any intelligence 
activities of the National Security Agency during the quarter ending 30 June 2003, 
were unlawful or contrary to Executive Order or Presidential Directive, and thus 
required to be reported pursuant to Section 1.7.(d) of Executive Order 12333. 


(U //FOU 0) The Inspector General and the General Counsel continue to 
exercise oversight of Agency activities by means of inspections, surveys, training, 
review of directives and guidelines, and advice and counsel. These activities and 
other data requested by the Board or members of the staff of the Assistant to the 
Secretary of Defense (Intellige^^ Oversight) a^e described in the enclosure. 



VITO T. POTEN5 
Acting General Counsel 


(U /^OUO) I concur in the report of the Inspector General and the General 
Counsel and hereby make it our combined report. 



End: 

a/s 

This Memorandum is Unclassified 
Upon Removal of Enclosure 
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1. (U) INSPECTOR GENERAL ACTIVITIES 

a.-( C//^) During this quarter, the Office of Inspector General (OIG) reviewed 
various intelligence activities of the National Security Agency/Central 
Security Service (NSA/CSS) to determine whether they were conducted in 
accordance with applicable statutes, Executive Orders, Attorney General 
procedures, and DoD and internal directives. With few exceptions, the issues 
presented were routine and indicated that the operating elements 
understand the restrictions on NSA/CSS activities. 


b. (U/^OUO^The NSA OIG completed an inspection of the National Security 
Operations Center (NSOC). The NSOC home page on NSA’s intranet has a 
new intelligence oversight (I/O) link containing the policy requirements 
related to I/O training and compliance; hyperlinks to the basic I/O 
documents; a reminder of the requirement to review the documents once a 
year; an on-line test, and the capability to register individual compliance in 
an I/O compliance database. The test results are used to indicate compliance 
with the mandatory training. The on-line program has been a success story: 
100-percent participation and a 100- percent pass rate by NSOC assignees. 


c. 4C//0f) Along with inspectors from the 


|b) (3)-P.L. 86-36 


[ the NSA (JIU completed an 

inspection of the Medina Regional Security Operations Center (MRSOC), 
Lackland Air Force Base, San Antonio, TX. The October 2000 joint 
inspection of the MRSOC noted numerous deficiencies in the site’s I/O 
program. The March 2003 inspection revealed that the I/O familiarization 
process is still fragmented and individual responsibilities are not well 
defined. This blurs accountability and does not track with the site’s 
governing oversight instruction, dated 15 November 2002. The process does 
not validate compliance and has no mechanism to enforce individual 
accountability. Consequently, coordinators and managers display little 
interest in or commitment to I/O compliance. USSID 18 training continues to 
be an issue because the MRSOC has not fully satisfied quarterly and annual 
training requirements for the past several years. The OIG joint report made 
several recommendations for improvement, which are being monitored for 
implementation. 
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d. tTS//SL‘/I’JF) 



_^ 1 :_ 


2. (U) GENERAL COUNSEL ACTIVITIES 


(b) (3)-P.L. 86-36 
(b) (3)-50 use 3024 
(b) (3)-18 use 798 


(i) 


(C/ZSI) The NSA Office of Genera! Counsel (OGC) reviewed various 
intelligence activities of the NSA/CSS to determine whether they were 
conducted in accordance with applicable statutes. Executive Orders, Attorney 
General procedures, and DoD and internal directives. The OGC advised 
Agency elements on a number of questions, including the collection and 
dissemination of communications of or concerning U.S. persons; the reporting 
of possible violations of federal criminal law contained in SIGINT product; 
the testing of electronic equipment; and the applicability of the Foreign 
Intelligence Surveillance Act (FISA). With few exceptions, the issues 
presented were routine and indicated that the operating elements 
understand the restrictions on NSA/CSS activities. The OGC did not file any 
reports with the Intelligence Oversight Board during this quarter. 


3. (U) SIGINT ACTIVITIES 

Collection Against U.S. Persons 


(1) (U) Intentional 


(S//SI) During this quarter, t he DI RNSA granted approval for 
consensual collection against 
consensual collection against 
this quarter. 


B ]persons. DIRNSA-approved U) 

U.S. persons was routinely terminai^<i'^^ 


^S//6D -The Attorney (general granted authority to collect the 
communications ol ] [ U.S. persons during this quarter. 

Additionally, in accordance with the Classified Annex to Department of 
Defense Procedures Under Executive Order 123 33, he orally approved 
the targeting of communications associated with| 


(b) (1) 

(b) (3)-P.L. 86-36 
(b) (3)-18 use 798 
(b) (3)-50 use 3024(i) 
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(b)(1) 

(b)(3)-P.L, 86-36 


( 1 > 
(b) (3; 
(b) (3; 
(b) (3; 


-P.L. 86-36 
-18 use 798 
-50 use 3024 
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(2) (U) Unintentional 


nb)(1) 

(b) (3)-P.L. 86-36 
(b) (3)-18 use 798 
(b) (3)-50 use 3024(i) 


a.- ffS//GI) 
tr affic tha 
to I 


an analyst found a telephone nu mber in 

]had passed 


J Since the number was 


the analyst used it as a query term in a 
raw traffic database and obtained several contacts to personnel at the 

1 The 

results indicated that the number might be associated with the 


_I so the analyst reviewed previous voice traffic and 

determined that the telephone number belongs to the 


who is a U.S. person. Except for the search in the database. 


the telephone number was never tasked for collection. 






1 

Ithat a 


Involved 


m|_|and linked to a known ] [ 

organization, was a U.S. person. The Office of Primary Interest 
immediately detasked the trafficker’s telephone number, deleted all 
audio intercepts for his telephone number, purged all pertinent 
transcripts from the transcript storage database, and cancelled all 
previously published reports based on his communications. 



(b) 

(1) 


OGA 



(b) 

(7) 

(C) 

(b) 

(7) 

(D) 

(b) 

(7) 

(E) 

(b) 

(7) 

(F) 


d . (TS//6I) DIRNSA gr anted a destruction waiverf 


incidental col 
of telephones 


ection a^ 


for 


use of these communications! 


Continued 
was determined to be 


a communications security/force protection issue. 


e. 4TS]yGI/N P') Due to a database error that occurred! 


Collection, authoriz ed 


in a FISA court order, di d not occur. | 

collection was terminated^ 


(b)(1) 

(b)(3)-P.L. 86-36 


(b)(1) 

(b)(3)-P.L. 86-36 


(b) (1) 

(b) (3)-P.L. 86-36 
(b) (3)-13 use 798 
(b) (3)-50 use 3024(i) 
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(b)(1) 

(b)(3)-P.L. 86-36 


/lb) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 


(b) (1) 

(b) (3)-P.L. 86-36 
(b) (3)-50 use 3024, 


Reviews of activity logs reve aled that some co llection had occurred 
after the court order expired ^ All product has been 

destroyed. 

f. (T3//3I) | the I issued a 

repo rt and later realized part o f the inform ation in the report came 
from] ~|in which ther 1 

I The collection on 

the telephone number was authorized by a F ISA court orde r. The 

report was canceled and reissued without the_ 

communications portion. 

(T0//0I) D uring routine target search and development operations, 

removed approximately^ pell phone identifiers from a (b)( 1 ) 

- ^ -1 * *ir**u u u ui (b){3)-P.L. 86-36 

_jsystem upon recognition that the numbers probably 

belonged to U.S. persons who called targets of interest. 


(b)(1) 

(b)(3)-P.L. 86-36 


h.t Ta//0I) The[ 
members of the 


]is tasked to collect the communications ofb) (i) 


After a member of thef 


(b) (3)-P.L. 86-36 


L8 use 798 
0 use 3024(i; 


advisee 


lestroy ail collection anc 


letask the relevant telephone numbers. 


i. the (jordon Regional Security Operations 

Center (GRSOC), Fort (jordon, GA, inadvertently c ollected a nd 
reported the communications of a U.S. offici al with [p erson. 

The unintentional collection was recognized | | and the 

report was cancelled. 

j. T5//5I//7’IF) This quarter, unintentional retrievals using the 

I F aw traffic (3) -P.L. 8 6-36 

resulted inj incidents against U.S. persons. All incidents were 
reported to responsible oversight officials and corrective actions were 
taken. All unauthorized traffic collected has been destroyed. 

b. (U//£0(d0) Dissemination of U.S. Identities 


(1) (U) Intentional 

- (6//SI) In acc ordance with section 7 ofUSSID 18, U.S. identities were 
disseminated j I times during this quarter. The following table (b)(1) 
shows the justification and the number of instances of dissemination: 

In the “Unmasked” column, the U.S. identity was revealed in a 


(b) {3)-P.L. 86-36 
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serialized end product; in the “User Requested” column, a U.S. identity 
was released to a user at the user’s request. 


JUSTIFICATION 

Unmasked User Requested TOTAL 

7.2.C Necessary 


7.2.C.1 Foreign Official 

7.2.C.3 International narcotics 

7.2.C.4 Criminal activity 

7.2.C.7 U.S. Government Official^ 

TOTAL 


i (S>E ach meation of an individual identifier in a single report is counted by the 
software as one dissemination. Thus, if an individual is mentioned five times in one 
report, the software tallies five disseminations. (b) 

(b) 


( 1 ) 

(3)-P.L. 86-36 


(2) (U) Unintentional 

(6//SI) During this 
they contained the 
Unintentional dissemination also occurred in circumstances other than 
reporting as follows; 


quarter]_pIGINT products were canceled becau^ 

identities or U.S. pjersons, organizations, or entities. 


( 1 ) 

(3)-P.L. 


86-36 


a . (0) A ltho ugh the ide ntities were minimized in SIGINT reports, 
several U.S.I jnames were included in summary report 


highlights posted on NSA’s intranet. Upon realizing the mistake, the 
SID staff removed the highlights from the intranet and reposted a 
minimized version. 

(b)(3)-P.L. 86-36 

b. (T3//3l M 


issued a 


based on collection involving l 

[was cancelled and the collection was destroyed. 


[which was later found to be 


The 


<b)(1) 

(b)(3)-P.L. 


86-36 


cr(TO//OI>-During routine over sight. SI D oversight officials identified a 
total of] I is sued byj [different_ 


_jthat contained the identities of U.S internet service 

pro viders (ISPs). Upon instruction from} ~[HQS,[ [cancelled 


thej 


and reissued them with th e proper m inimization. In 

Headquarters emailed | reminding them that 


addition, 

U.S. ISPs are considered U.S. entities and must be minimized in[ 


(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 
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Furthermore, durin g the "U.S. Identities in SIGINT" briefing to the 
I ~| SIG1NT Reporting Workshop, SID oversiglft) < ^ '> 

officials will emphasize that certain ISPs are U.S. companies 7^9 


to be minimized in SIGINT reports. 


(b)(3)-50 use 3024(i) 


d. (TS//6 I^__ issued an | [ contain ing the 

name of a se nior U.S. official. I I cancelled and reissued the >r 
_identifying the official by title only. 


(b) (1) 

(b)<3)-P.L. 86-36 


e. (T0//0I) The Kunia Regional Security Operations Ce nter issued 
reports containing informa tion related to a named U.S j 
loc ated I \ The report was cancelled and reissued with 

the |name minimizea. 

■<b) (1) 

(3) (U) Raw Traffic Dissemination Outside the SIGINT 
Production Chain 


(S//SI) I SID Oversight an d Compliance Office (O&C) 

became aware thatl [assigned to thef I 

I had 

unauthorized access to numerous raw traffic databases. Over the next 

\ O&C determined tha t some of these individuals were 

authori zed access while working in 

[; however, these accounts were neither deactivated nor 

properly re-justified when the personnel were reassigned. Other 

individuals gained access because they identified themselves as 

assigned to| [without providing amplifying information and 

it was erroneously assumed that they were assigned to the| | 

O&C received no response to a request for infor mation about h ow the 

accounts were being used and, on approximately! |had the 

accounts deactivated until a request for authorization could be 

processed within established channels. .(i) 

(b) (3)-P.L. 86-36 

( 8 // S I) r the SIGINT Director directed that \iie c 3 2 (i) 

accounts be reinstated when he received assurances froml 

__, th at I I might assign a 

mission to I \. Onorabou t | [ the ACO spoke with 

the NSA I ~1 who confirmed that | I was not 

assigned an NSA | |mission, which subsequent investigations 
confirmed. Access for | was not cancelled, however, because 

the leadership of Analysis and Production, SIGINT Directorate, 
wanted access retained fori I_ 


Although O&C has received 
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information justif 5 ang the current accounts, it has received no 
information covering the unauthorized access prior to May. Although 
the investigation has not been completed, at this time, it appears that 
access to na tional databases was used to prosecute an unspecified 
_target, rather than any NSA mission. 


4. (U) OTHER ACTIVITIES 

(U) Integrees in Analysis and Production 


(bUl) 

(b) CSK-P.L. 86-36 


~XS//3I//?fFf During this quarterj 


In all cases, these individuals were provided with USSID 18 trainini 


Organizations having integrees at NSA includedf 



(b) (1) 

(b)(3)-P.L. 


(U) Assistance to Law Enforcement 

a. (S/ZSI/Z^fF) During the quarter, NSA received a request from the 
Department of Justice under Section 105a of the National Security Act of 
1947, which allows NSA to provide support to law enfo rcement if the t arget is 
foreign and is located overseas. NSA support includedi_| 


In accordance with standard practices for such requests, the SID forwarded 
the results directly to the OGC for vetting before dissemination. 

br-(0//0ftThe SID approved ! [ requests for technic al assistance from law 
enforcement during this qu arter. Assistance included_ 


(b) (1) 

(b) (3)-P.L. 86-36 
(b) (3)-ie use 798 
(b) (3)-50 use 3024(i) 


(b) (1) 

(b) (3)-P.L. 86-36 
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(U) Working Aids 


a. (U) All SID personnel at NSA Headquarters and in the Extended 
Enterprise have access to the document, “U. S. Identities in SIGINT,” and 
other guidance documents either in hard copy or via NSA’s intranet. SID 
personnel are cognizant of NSA/CSS Directive 10-30 and review it as 
necessary to ensure compliance with the directive. Several offices in SID 
maintain files to be used to prevent targeting of U.S. persons. 


b. (U// yOUO mSA 


redesigned its home web page 


{■£>) (3)-P.L. 86-36 


to include an Intelligence Oversight link. As part of their quarterly training, 
I [ personnel are required to access the site, read its 

contents and complete the form at the end signifying they completed the 
required training. 


c. (U/ /rOUO) The SID has also developed a web-based training program that 
currently is in beta testing. This program is designed to provide lists of 
individuals within an office who have completed the training. 


(U) Databases 

_ (6//6I) Numerous branches in 


Iconsistent with QGC guidance. 


UteTd) 

^(b)(3)-P.L. 86-36 


3to avoid 


USSID-18 violations. O nly information that is essential to understanding the 
intelligence is included. | 

I Additionally, many Offices of 


Primary Interest ] 

in order to ensure that they are not collected against or nameci in 


product. 


ledii 


8 

TOP 5CCRET//COMINT//NOR)RN//X1 





